claim[.]unites[.]run

claim.unites.run was observed in the wild as a brand‑impersonation site targeting Binance users. The domain was registered on 21 February 2026 and currently resolves to the IPv6 address 2606:4700:3030::6815:1001, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title “Unite” but no additional content has been captured because the host has been taken offline at the time of reporting. Security‑vendor scans on VirusTotal show that 2 of 95 engines flagged the domain as malicious, indicating limited but non‑trivial detection.

Independent reputation services have assigned a trust score of 0 / 100 on Gridinsoft, and the domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer. The TLS certificate presented is identified as “WE1”, confirming that the site used HTTPS despite its malicious purpose. The observed behavior aligns with a crypto‑scam classification, where threat actors commonly lure victims into revealing Binance credentials or sending funds. While the limited number of vendor detections suggests the payload may not have been widely distributed, the presence on multiple blocklists and the zero‑score trust rating warrant elevated concern.

Defenders should block the IPv6 address 2606:4700:3030::6815:1001 at the perimeter, add claim.unites.run to URL filtering policies, and monitor for any outbound connections to Cloudflare‑hosted resources that match this address. Endpoint detection rules should be tuned to flag attempts to resolve or contact the domain, and any Binance‑related credential theft alerts should be correlated with this indicator. Because the site is offline, further dynamic analysis is not possible, but continuous watch‑listing is recommended in case the infrastructure is re‑used under a different domain.